In a Single Logout (SLO) scenario, what mechanism is typically used to inform the IdP that the user has logged out of the SP?

Question

Options

• AThe SP sends an HTTP POST request to the IdP's logout endpoint.
• BThe user's browser automatically sends a logout request to the IdP.
• CThe IdP periodically polls the SP to check for user logout status.
• DThe user manually logs out of the IdP after logging out of the SP.

• A
  89% (17)
• B
  5% (1)
• D
  5% (1)

Explanation

In SAML-based Single Logout, when a user logs out of a Service Provider (SP), the SP initiates the logout flow by sending a LogoutRequest message to the Identity Provider (IdP) - typically via an HTTP POST (or HTTP Redirect) to the IdP's designated SLO endpoint, which is why A is correct. Option B is wrong because the browser itself has no built-in awareness of federation protocols; it only acts as a transport vehicle directed by the SP's response. Option C is wrong because SLO is event-driven, not poll-driven - polling would introduce unacceptable latency and overhead for a security-sensitive operation. Option D describes a manual fallback that defeats the entire purpose of Single Logout, which is to propagate logout automatically across all sessions.

Memory tip: Think of SLO as a chain reaction - the SP pushes a logout signal to the IdP (POST), and the IdP then fans out that signal to any other SPs in the session. The SP always acts first; nothing is automatic, polled, or manual.

No community discussion yet for this question.